Malicious PDF — malware analysis report

Static analysis result for SHA-256 01ecc15edfa7e344…

MALICIOUS

PDF

51.5 KB Created: 2020-09-02 22:04:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 174caa7b4afd4466d5e8582f2ab644fa SHA-1: f2a9068a7ba99db167a732f44d6622ba0cbbab03 SHA-256: 01ecc15edfa7e3447b81204e4ccb1848299ebc22de5249b92ec268fd14be6673
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link that redirects to a malicious domain, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body text, though partially corrupted, includes the same URL, suggesting a lure for users seeking free math answers. The PDF_SEO_LINK_FARM heuristic indicates a large number of outbound links, many of which are benign, likely to obscure the malicious redirector.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=math+answers+to+all+problems+for+free
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/856cea_dad1413ad3c5413e90c58fd527ea5203.pdf
    • https://static.usrfiles.com/ugd/e4ff69_c1c663556acb4e6f935a9bf5e0b24dac.pdf
    • https://static.usrfiles.com/ugd/b7082a_89047a8a381847bfaa0d0fc98f16a06e.pdf
    • https://static.usrfiles.com/ugd/74a852_3e628eeb27a64ea489068e666f6ef234.pdf
    • https://static.usrfiles.com/ugd/b8c837_f44beb747a9245f6bf874a2b572fcb98.pdf
    • https://static.usrfiles.com/ugd/0789d5_61a177508f774b3eb6c910b28f8e0c3c.pdf
    • https://static.usrfiles.com/ugd/b8c837_40d1519768de4423a4f0c07f2cd1766f.pdf
    • https://static.usrfiles.com/ugd/55e2c6_5f934258b4a146789079a59acaca5456.pdf
    • https://static.usrfiles.com/ugd/3b47cb_226678bfadcf444ea025dd72fec881ce.pdf
    • https://static.usrfiles.com/ugd/1c8c6c_4e03600d8d9f4851a6e123590be94c22.pdf
    • https://static.usrfiles.com/ugd/d51d36_7b8576c7d7144225a4b1e6dcd3506377.pdf
    • https://static.usrfiles.com/ugd/07e02c_890754a516c8453ca4fcb688708f6db9.pdf
    • https://static.usrfiles.com/ugd/8e1900_0e93de641fec4c3893b885c2c139ac03.pdf
    • https://static.usrfiles.com/ugd/3f4b99_5dfc5b716451400b9804427aed945380.pdf
    • https://static.usrfiles.com/ugd/87d215_f26a77bd25d94bbb9a0edbcfd53b73e6.pdf
    • https://static.usrfiles.com/ugd/4117a9_2ca5fe746b954de4abf4e57a23f42d18.pdf
    • https://static.usrfiles.com/ugd/10e3af_373645ad1ff54e4d9ce3fd41101b7999.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006e2e.bin
c2760f90c2647cda088bce89a585c959e66bd46625e435364452cf063f405883		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E2E 5380 bytes
font_01_sfnt_off00008067.bin
614c3ffcc9aa4b6d76f25ceddf67c42dad67887396ab7c0a3609c021ca62fafd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8067 10624 bytes
font_02_sfnt_off0000a4de.bin
583c948ba6eb349713ced79d30858fe2de46ed42baefbe44503f9e3681d2ccda		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA4DE 18032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.